 (defn- system-permissions-granted-by-acls
   "Returns a set of permission keywords granted on the system target to the given sids by the given acls."
   [system-object-target sids acls]
-  (collect-permissions (fn [acl permission]
-                         (and (= system-object-target (:target (:system-object-identity acl)))
-                              (acl/acl-matches-sids-and-permission? sids (name permission) acl)))
-                       acls))
+  (let [relevant-acls (filter #(-> % :system-object-identity :target (= system-object-target))
+                              acls)]
+    (set
+      (for [permission [:create :read :update :delete]
+            :when (some #(acl/acl-matches-sids-and-permission? sids (name permission) %)
+                        relevant-acls)]
+        permission))))
 
 (defn get-system-permissions
   "Returns a map of the system object type to the set of permissions granted to the given username or user type."

  [_]
  (cpv/merge-params-config
    cpv/basic-params-config
    {:single-value #{}
     :multiple-value #{:permitted-group :identity-type :provider}
     :always-case-sensitive #{}
     :disallow-pattern #{:identity-type :permitted-user :group-permission}
     :allow-or #{}}))

(defmethod cpv/valid-parameter-options :acl
  [_]

                       (mdb/get-latest-concept context parent-id)))
      concept)))

(defn get-catalog-item-permissions
  "Returns a map of concept ids to seqs of permissions granted on that concept for the given username."
  [context username-or-type concept-ids]
  (let [sids (get-sids context username-or-type)
